Move issuance pending from Deferred Credential Error Response to Deferred Credential Response and move interval parameter to Credential Response #492

paulbastian · 2025-05-07T16:00:35Z

Closes #1
Closes #226

I moved the pending_issuance Deferred Credential Response Error to the regular Deferred Credential Response
I moved the interval parameter from Deferred Credential Response Error to the Credential Response
I changed the interval from OPTIONAL to REQUIRED (see thread discussion)
I added an example of a Deferred Credential Response containg no Credentials but only new interval

…rred Credential Response, move interval to Credential Response

openid-4-verifiable-credential-issuance-1_0.md

Co-authored-by: Timo Glastra <timo@animo.id>

openid-4-verifiable-credential-issuance-1_0.md

Co-authored-by: Stefan Charsley <charsleysa@gmail.com>

openid-4-verifiable-credential-issuance-1_0.md

awoie

generally fine with the direction but we should consider interval being mandatory.

Co-authored-by: Tobias Looker <tobias.looker@mattr.global>

openid-4-verifiable-credential-issuance-1_0.md

Co-authored-by: Joseph Heenan <joseph@authlete.com>

openid-4-verifiable-credential-issuance-1_0.md

tplooker · 2025-05-23T09:34:59Z

openid-4-verifiable-credential-issuance-1_0.md

+Deferred Credential Response may either contain the requested Credentials or further defer the issuance:
+
+* If the Credential Issuer is able to issue the requested Credentials, the Deferred Credential Response MUST use the `credentials` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 200 (see Section 15.3.3 of [@!RFC9110]).
+* If the Credential Issuer still requires more time, the Deferred Credential Response MAY use the `interval` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).


Suggested change

* If the Credential Issuer still requires more time, the Deferred Credential Response MAY use the `interval` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).

* If the Credential Issuer still requires more time, the response MUST use the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).

I think we're significantly under defining the "still requires more time" response now, it must include interval right?

yeah, I caught the same in the meantime :) However my suggestion was to require interval in the new response. WDYT?

@paulbastian I'm good with that.

Co-authored-by: Tobias Looker <tobias.looker@mattr.global>

jogu · 2025-05-23T09:35:07Z

openid-4-verifiable-credential-issuance-1_0.md

+* If the Credential Issuer is able to issue the requested Credentials, the Deferred Credential Response MUST use the `credentials` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 200 (see Section 15.3.3 of [@!RFC9110]).
+* If the Credential Issuer still requires more time, the Deferred Credential Response MAY use the `interval` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).
+
+The Deferred Credential Response MAY use the `notification_id` parameter as defined in (#credential-response).


I think this should be in the "is able to issue" paragraph?

jogu · 2025-05-23T09:38:46Z

openid-4-verifiable-credential-issuance-1_0.md

+Deferred Credential Response may either contain the requested Credentials or further defer the issuance:
+
+* If the Credential Issuer is able to issue the requested Credentials, the Deferred Credential Response MUST use the `credentials` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 200 (see Section 15.3.3 of [@!RFC9110]).
+* If the Credential Issuer still requires more time, the Deferred Credential Response MAY use the `interval` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).


I think we're significantly under defining the "still requires more time" response now, it must include interval right?

sloops77 · 2025-05-23T21:19:22Z

openid-4-verifiable-credential-issuance-1_0.md

 ## Deferred Credential Response {#deferred-credential-response}

-The Deferred Credential Response uses the `credentials` and `notification_id` parameters as defined in (#credential-response).
+A Deferred Credential Response may either contain the requested Credentials or further defer the issuance:


The response can also indicate that there are no credentials for the holder (for a variety of reasons) and that the wallet should not poll any longer. I think it's worth adding normative description of what this response looks like. One of the following probably:

204

200 with an empty response

200 & and empty credentials array

400 & error credential_request_denied or a new error code such as no_deferred_credential

I think this is out of scope for this PR. I'll convert it into a new issue instead.

sloops77 · 2025-05-24T00:19:57Z

@paulbastian This PR brings even closer alignment between the credential and deferred endpoints. I think WG should reconsider merging them.

It would mean transaction_id is acceptable on the credential request, along with the corresponding extra error response.
Additionally is there a benefit in allowing proofs to be resent on each request?

paulbastian · 2025-05-24T05:55:24Z

@paulbastian This PR brings even closer alignment between the credential and deferred endpoints. I think WG should reconsider merging them.

It would mean transaction_id is acceptable on the credential request, along with the corresponding extra error response.

Additionally is there a benefit in allowing proofs to be resent on each request?

Yes. I'm pushing in the same direction. Consider it a preparation step.

GarethCOliver · 2025-05-27T18:46:24Z

@paulbastian This PR brings even closer alignment between the credential and deferred endpoints. I think WG should reconsider merging them.

It would mean transaction_id is acceptable on the credential request, along with the corresponding extra error response.

Additionally is there a benefit in allowing proofs to be resent on each request?

+1 to this. Having two versions of the same thing lead to exactly this sort of skew. It'll be valuable for future implementors to also know that the message for the request/response are necessarily, simply with slightly different restriction.

Move issuance pending from Deferred Credential Error Response to Defe…

3c93c9d

…rred Credential Response, move interval to Credential Response

paulbastian changed the title ~~Move issuance pending from Deferred Credential Error Response to Defe…~~ Move issuance pending from Deferred Credential Error Response to Deferred Credential Response and move interval parameter to Credential Response May 7, 2025

TimoGlastra reviewed May 8, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

Sakurann requested review from GarethCOliver, Sakurann, awoie, bc-pi, c2bo, charsleysa, danielfett, jogu and martijnharing May 8, 2025 15:18

Update openid-4-verifiable-credential-issuance-1_0.md

cfa0c0f

Co-authored-by: Timo Glastra <timo@animo.id>

charsleysa reviewed May 8, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

Update openid-4-verifiable-credential-issuance-1_0.md

9a3cf64

Co-authored-by: Stefan Charsley <charsleysa@gmail.com>

charsleysa approved these changes May 8, 2025

View reviewed changes

tplooker reviewed May 8, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

awoie reviewed May 20, 2025

View reviewed changes

paulbastian and others added 2 commits May 23, 2025 11:27

Update openid-4-verifiable-credential-issuance-1_0.md

4aa7301

Co-authored-by: Tobias Looker <tobias.looker@mattr.global>

Merge branch 'main' into pb/deferred_issuance_error_response

eda7a05

tplooker reviewed May 23, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

jogu reviewed May 23, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

Update openid-4-verifiable-credential-issuance-1_0.md

9548858

Co-authored-by: Joseph Heenan <joseph@authlete.com>

tplooker reviewed May 23, 2025

View reviewed changes

openid-4-verifiable-credential-issuance-1_0.md Outdated Show resolved Hide resolved

tplooker reviewed May 23, 2025

View reviewed changes

paulbastian and others added 2 commits May 23, 2025 11:36

added Deferred Credential Response example

f743e5f

Update openid-4-verifiable-credential-issuance-1_0.md

b849d0f

Co-authored-by: Tobias Looker <tobias.looker@mattr.global>

jogu reviewed May 23, 2025

View reviewed changes

sloops77 reviewed May 23, 2025

View reviewed changes

GarethCOliver approved these changes May 27, 2025

View reviewed changes

Sakurann added this to the Final 1.0 milestone May 28, 2025

jogu mentioned this pull request May 30, 2025

Clarify how deferred credential response indicates the issuer no longer plans to issue a credential #532

Closed

jogu approved these changes May 30, 2025

View reviewed changes

Merge branch 'main' into pb/deferred_issuance_error_response

e6437fa

jogu merged commit 16c8797 into main May 30, 2025
2 checks passed

jogu mentioned this pull request May 30, 2025

Add support for request encryption to credential endpoint and request/response encryption to deferred credential endpoint #505

Merged

GarethCOliver mentioned this pull request Jun 3, 2025

Security Considerations for Encryption #538

Closed

	* If the Credential Issuer still requires more time, the Deferred Credential Response MAY use the `interval` parameter as defined in (#credential-response) and MUST respond with the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).
	* If the Credential Issuer still requires more time, the response MUST use the HTTP status code 202 (see Section 15.3.3 of [@!RFC9110]).

Move issuance pending from Deferred Credential Error Response to Deferred Credential Response and move interval parameter to Credential Response #492

Move issuance pending from Deferred Credential Error Response to Deferred Credential Response and move interval parameter to Credential Response #492

Uh oh!

Conversation

paulbastian commented May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

awoie left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tplooker May 23, 2025

Choose a reason for hiding this comment

Uh oh!

jogu May 23, 2025

Choose a reason for hiding this comment

Uh oh!

paulbastian May 23, 2025

Choose a reason for hiding this comment

Uh oh!

jogu May 23, 2025

Choose a reason for hiding this comment

Uh oh!

jogu May 23, 2025

Choose a reason for hiding this comment

Uh oh!

jogu May 23, 2025

Choose a reason for hiding this comment

Uh oh!

sloops77 May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jogu May 30, 2025

Choose a reason for hiding this comment

Uh oh!

sloops77 commented May 24, 2025

Uh oh!

paulbastian commented May 24, 2025

Uh oh!

GarethCOliver commented May 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

paulbastian commented May 7, 2025 •

edited

Loading

sloops77 May 23, 2025 •

edited

Loading